EIP-2026-114651

This is a technical writeup describing a null byte injection vulnerability in 'File Download 1.3' PHP script, allowing remote attackers to bypass file extension restrictions and download arbitrary files. The exploit leverages a null byte (%00) followed by an allowed extension to trick the script into serving unauthorized files.